Webhooks on soft-deleted posts

[sburkett]

I'm not even sure why I can reply to soft-deleted messages, but nevertheless, it seems to still trigger the related webhook.

Running beta 15.

[dsevillamartin]

Can you clarify? Is the discussion soft-deleted, the first post soft-deleted, or...? I'm not sure exactly what the situation you are describing is or what the related webhook is either.

[sburkett]

Sorry, was in a bit of a rush when I posted that yesterday. The discussion was soft-deleted. I've confirmed this by looking in the discussions table, and I can see the hidden stamp.

Though, it does seem strange. This is probably a core issue, but the admin user can see the soft-deleted discussions, which makes sense, but so can the creator, which seems sort of weird. And the admin and creator (at least) can still reply to it, though I haven't tried any other user accounts.

Unless I'm missing something, there doesn't seem to be an option (or permission) inside of Flarum to prevent people from replying to their own threads that are soft-deleted.

[dsevillamartin]

I don't think that's an option in core, yeah. Do you have the webhook set to Admin or Guest viewing?

[sburkett]

Ah, that is probably the reason why. I ended up having to do Admin, since Guest wasn't working for me. Not sure why Guest wasn't working, unless it truly means a "guest", as in a non-registered member. This particular site is a member's only site for a gaming guild.

[sburkett]

If my hypothesis above is correct, would it be possible to add actual defined groups to the dropdown, rather than just "Admin" or "Guest"?

[dsevillamartin]

Not sure why Guest wasn't working, unless it truly means a "guest", as in a non-registered member. This particular site is a member's only site for a gaming guild.

That'd be why :)

If my hypothesis above is correct, would it be possible to add actual defined groups to the dropdown, rather than just "Admin" or "Guest"?

I tried, and failed.

The problem with this (at least how I attempted to implement it) is that Flarum uses actual users and checks permissions against them - if I create a fake user that isn't in DB the permission checks will try to access things in DB and most likely error. This was a long time ago so things may have changed, though I don't think so.

There might be another way to implement it or I may also have just been doing something wrong. 🤷 I just remember the permission checks not working as they should've.

[dsevillamartin]

Closed due to the question asked being resolved. An issue already exists for improved Group support, see #43.